Hacker News Reader

Comment by pushcx | Hacker News Reader

This post would be improved by discussing that their [threat model](https://en.wikipedia.org/wiki/Threat_model) is so different than Google's that it regards some of Google's business practices as threats. And that, in turn, there are threats that Google treats as much bigger threats, bringing their own world-class security team to.

Calling this fundamental difference in approach "more secure" manipulates the less-informed instead of educating and almost eliminates the chance of a worthwhile conversation about tradeoffs and values that could be very flattering to ProtonMail.

View on HN

That's a fair criticism. I don't think the Gmail glossy brochure mentions its threat model either.

They do for their new Advanced Protection Program[1]. The regular Gmail service is not really marketed to the security concious users.

It's like comparing Android to Qubes OS. Not really fair. For what they are, Google products are surprisingly secure.

[1] https://landing.google.com/advancedprotection/

Qubes has a nice fat attack surface known as the hypervisor. I'm skeptical when people point to this as the panacea of computing security.

In practice it's a rather thin attack surface and serious cloud providers rely on it so it's both well-tested and any exploit can be used on much more valuable targets than your OS.

It's not a panacea. There are physical threats, there are threats from the very hardware you're using. But, like it says on the box, it is a reasonably secure operating system.

Yes, Qubes is only as secure as Xen which, itself, has had some pretty big security flaws pop up [1]. At the end of the day one has to decide what kind of trade offs they are willing to make in order to balance simple UX and security.

[1] https://blog.quarkslab.com/xen-exploitation-part-2-xsa-148-f...

And, in turn, as secure as the hardware, with ROWHAMMER giving means to flipping bits in arbitrary memory locations, including recent work showing that one VM can flip bits in another.

For Qubes 4, they are planning to deprecate the Xen paravirtual drivers in favor of the HVM drivers. These drivers are much more battle-tested and less complicated than PV drivers.

Also, with their recent foray into enterprise support, they will hopefully be able to expand their auditing efforts in the next couple of years.

I think the parent was talking about sandboxing and permissions

Does anyone have experience using Google’s advanced protection service? I’m wondering if it’s worth managing the dongles.

I signed up last week and it isn't inconvenient at all. Security keys are only used when you first sign in to a device, after which devices are "remembered."

> "Google products are surprisingly secure"

For one their products are not "secured" from Google seeing your private data...

Neither is ProtonMail. They see all email plaintexts unless you're using end-to-encryption like GPG/PGP. They only encrypt data at rest, and we can only take them at their word that they're even doing that.

They claim (tho I haven't confirmed myself) to do encryption at the device - automatically between Protonmail accounts (right now though, they do not support sending pgp encrypted email to a protonmail account with a keypair not generated by them... Which seems a _very_ odd design decision):

In simple terms, end-to-end encryption means that messages are encrypted on the sender’s device (before it even leaves their computer or mobile phone), and can only be decrypted by the recipient on their device. This means that no third party which transmits or intercepts the email between the sender and recipient (i.e. internet service providers, the NSA, or even ProtonMail as the mail server operator) can decrypt and view the message.

This powerful protection is possible because ProtonMail has PGP email encryption built-in. End-to-end encryption is done automatically without user interaction whenever messages are exchanged between ProtonMail users. For an enterprise using ProtonMail for their email hosting, this means all communications between employees are automatically protected with end-to-end encryption. ProtonMail can also support sending/receiving end-to-end encrypted messages with recipients who are not using ProtonMail. The use of end-to-end encryption makes ProtonMail a better choice for security conscious individuals and organizations.

Using keypairs generated by them is the same as not encrypting the emails at all ...

> End-to-end encryption is done automatically without user interaction whenever messages are exchanged between ProtonMail users.

Which would correspond to a tiny fraction of all email a normal user exchanges and Even corporate users would be unprotected if they were to use protonmail to communicate with third parties such as service providers.

Protonmail has the ability to get all your messages plaintext. Because they have to SEND your email to the recipient. Unless you encrypt the plaintext, when you jump domains and email someone outside of protonmail, they can get text

Gmail isn't floating around any brochures on security though - it's pitch to the majority of its users is "It's Google and Mail and where most people have their emails. You don't want to be that one weirdo at @yahoo.com do you?" and that just about does it. ProtonMail is trying to recruit users with the brochure.

That said, even though the argument is a bit flawed here, I think most attracted by it would still prefer ProtonMail for other sound arguments.

Do you really believe people use gmail because of its brand?

I don't know about any security brochure, but I know I can setup 2FA to use push notifications (not an insecure SMS number), and can check where all of my logins are from, and have "suspicious" logins blocked automatically, etc, etc. I can also create single-use passwords for insecure devices (such as a youtube password just for my apple TV). Not to mention how amazing they are about spam detection.

I think their security posture is actually excellent.

There are absolutely people (many of them) who use GMail because of its brand. They most commonly will say "GSuite" though.

Yes, absolutely. I would guess at least 90% of the users are simply there by defaulting to it. The tech community is not the target market for Gmail. I never said they had bad security, simply that they were not advertising and trying to attract users from it.

Do you really believe people use gmail because of its brand?

Yes. Most definitely. I don't use Gmail and I recently had a discussion with my coworkers about Gmail. When I asked why they use it one person said, "because it's Google" and another said, "What else would I use? Yahoo or Hotmail? Hahahah". A third person responded by saying , "it's just easy because it's Google so it connects to everything else from them."

Many people think google is professional. My AP lit teacher said so. I thought it was stupid at the time, but in terms of professional capability, google offers the most services (at the cost of surveillance and advertising). And many other people would question using something like hotmail or yahoo because it's different.

> Do you really believe people use gmail because of its brand?

Absolutely. No doubt in my mind.

That sounds a bit formalistic and abstract to me. Perhaps you could educate us on which specific threats you think we should pay attention to when choosing between Gmail and Protonmail.

What are some specific threats that Gmail defends us against more effectively than Protonmail?

Off the top of my head I think the number 1 "threat" that Google doesn't protect you from is privacy. They are actively watching your email with algorithms to use for advertising purposes.

On the other hand, they have more resources than anyone else to protect against things like DDOS, nation-state hacking/phishing, and physical disasters. They also have a legion of lawyers to protect against improper legal requests, however they will roll right over for a government if it's legal.

Protonmail is on point with the privacy, but their security engineering team is probably less than 1/10th that of Google's.

I think the right size of any security engineering team is largely determined by the diversity of threats it has to defend against. Same for the legal team.

So team size alone doesn't convince me one way or the other, even if I were to completely disregard all privacy issues.

I am a Gmail user as is my company, so I do trust them quite a bit. But I feel that Google has a much bigger problem on its hands than Protonmail. Both because of its business model and because Gmail does things like search and spam filtering, which Protonmail cannot do.

[Edit] Protonmail actually does spam filtering.

Except this is no longer true. Google does not read your gmail anymore.

https://blog.google/products/gmail/g-suite-gains-traction-in...

From the link: "G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service."

They are definitely still reading your gmail. How else would the spam and other filters work? They can also use it under this policy for anything but "ads personalization". Machine learning, Google product integration, other recommendation not deemed to be ads, refining your google profile, etc. A very narrow scope of exclusion.

Well, one might reasonably ask whether "reading your mail" (as in, running an algorithm on it to try to classify phishing vs non) is a security cost or benefit.

Spearphishing is a huge source of compromise at the moment; antiphishing filters might, in that view, be considered a security feature rather than a security fault.

On the other hand, I have, frankly, never understood these privacy arguments. Is it a privacy violation if someone checks a checksum of my incoming mail against a blacklist? What if they compute a hash of my mail to check the DKIM signature? And if those are OK, why is an ML model more of a problem?

>Is it a privacy violation if someone checks a checksum of my incoming mail against a blacklist?

No, the privacy concern is about the potential for abuse if there is a known place in the world where a very detailed account of all my online (and some offline) activities, contacts, communication and personal interests is stored.

It obviously arouses the interest and desires of criminals, governments, employers, politicians, landlords, insurance companies, creditors, marketers, ex partners, extremists and bigots, journalists, potential mates, researchers, etc.

Some of these groups are overlapping and some of the concerns might only arise in the distant future. Governments change. Ownership of companies changes. Personal circumstances and opinions change, but you can't take anything back once its out.

Spam filters don't need to store all the contents. They can simply store hashes of contents.

So even if someone hacks into the spam filters, they won't be able to reconstruct content from your account. They _might_ have insight into things like word usage, but they won't have reconstructed sentences or the like, a priori.

You can build systems like this without having long-term storage of the content, which protects against data issues for one-time leaks.

Given their vast amounts of information about mail, might their spam filter work by only examining the header? That is, of course, still 'reading' mail - though it may be an acceptable trade off for privacy minded people.

And, if it's being interpreted by a machine, does that really count as reading?

So I ordered some cigars online the other day. I did this on a device not logged into google, in privacy mode.

An email with the order went to my @gmail. The next day in my Youtube videos the ads where for stop smoking patches.

They read email.

Google also allows ads targeting a list of emails. Could be that the cigar seller asked google to show you the ads.

Why would the cigar seller ask to show me an ad for a STOP SMOKING CIGARS product? Also as I said, this showed up in Youtube the day after I ordered and the email hit my gmail. Never seen those ads before.

The cigar seller sells its customer list to a data broker or uses a third party service that does the same (e.g. it uses your email address as a user identifier in a third party analytics product). Then advertisers buy that data.

The sold it in less then 24 hours?

Well, it's not like they need to ship the list of email addresses across the company in a truck.

> They read email.

Sometimes hilariously. A few years ago a friend emailed me a barbershop quartet video, and I spent the next couple of weeks getting hairdresser ads ...

Until it becomes lucrative to do so again.

Protonmail says they have no access to user data and so I guess that means they offer zero protection from spam and emailed threats.

One could argue that Google's filtering of spam and potentially harmful mail is a point in favor of Google.

SMTP has headers that are visible to the email provider while the email is in transit. The absence of logs, etc., goes far to mitigate this threat. As an added benefit, there is a lot of anti-spam functionality that can be used with only this metadata available, and only ephemerally. I don't think it's true that zero-knowledge at rest means inability to provide common email provider value adds like anti-spam.

To add to the above post, the headers have to be unencrypted, else they'd have no method to actually send the email. If it were encrypted, they'd have no idea what the address was, or who to bounce it to if the address doesn't exist.

Email headers contain a lot of information. It has the various email addresses, servers involved, ip addresses, time stamps, subject, priority, and things like that.

The body of the email is the only part that gets encrypted when encryption is in use.

You are conflating the SMTP envelope and the mail headers. The SMTP envelope is necessary for delivery, the mail headers are not (the addressee information is duplicated)

Thanks for the correction. I had originally typed 'meta data' but thought headers were the same thing. Thanks!

Whatever happened to filtering client side?

Not much. It's as bad now as it was a decade ago.

In other words, about as good as gmail but with better control over false positives.

For me, Gmail solves the spam problem. I don't even remember the last time I've had a false positive or a piece of spam that made it to my inbox.

My entire family uses Gmail (our domain is hosted via Google Apps) and as far as I know, it's been very close to perfect for all of us.

Well, do you really check your spam folder all the time? There might be false positives that you miss.

There are also false positives than never make it into your spam folder - that just get dropped silently. (I have a friend who's company's GSuite email _regularly_ does this...)

If Protonmail servers are hacked, it's game over (that could be mitigated by having verified client code, but at this time there's the web client that is served dynamically, and the mobile clients are closed source...). That is where Protonmail are at a huge disadvantage unless they have a really really good security team. Server hacking is done a dime a dozen nowadays.

That's a threat that Gmail faces as well though.

With a security budget several orders of more, yes.

Google also has much more diverse security problems to solve so that's not a good argument either way.

It has to have a larger budget, it's operating on a larger scale.

It can be simplified to:

Gmail + 0$ per month = zero privacy for you and anyone who emails you, plus Uncle Sam has full access to your life.

Protonmail + 4$ per month = you will never see ads for a <insert_item_name> like the one you just bought, plus you will be driving Uncle Sam crazy!

Uncle Sam can root your machine. If Uncle Sam is the threat vector you're better off using pen and paper.

That costs Uncle Sam resources at scale.

Uncle Sam can't root everyone's machines at once. If Uncle Sam wants mass surveillance it's going be through the provider.

Intel Management Engine.

That is only remotely exploitable if you use Intel network cards.

There’s a reason all my systems use other cards, and are behind a hardware firewall specifically configured for my use cases.

There is still a possibility, a scenario only a crazy conspiracy theorist could imagine a few years back, but I believe the current development of closed chipsets could soon allow remote penetration into any machine using any network card by any vendor, and in a way that nobody can even sniff the suspicious traffic over the network. It seems really complicated, if not impossible, but I'm starting to think it can be done if one has full access to the chipsets and their firmware (users, admins and developers don't, vendors and their "partners" do).

Let's assume a system where every piece of hardware has a closed device driver, or part of it, CPU included. We're there, or very close. It's not that hard to imagine a system within the system that can access data (hard drives have closed blobs), read passwords before they are encrypted through keylogging (USB sniffing), make screenshots of the desktop (video card closed blobs) and send them wherever they're instructed to (network card blobs), not to mention downloading and executing arbitrary code.

Now one could object that the traffic could be easily intercepted, but what if all network chipsets of all vendors, including those inside routers, had a small set of instructions to intercept any magic packet satisfying some rules and treat it differently. Let's say send it to some hardcoded addresses without counting them or reporting them to user applications; even leds on front panels would not report those packets passing through. The only way to realize something fishy is going on would be by tapping physically into the network cable using non-network dedicated chipsets, say very fast digital analyzers, decode all traffic and match it with what a normal sniffer would report.

I admit this is a crazy scenario, but if an entity with nearly infinite resources had the power to force any hardware vendor to put spying hardware/firmware into every machine, wouldn't it attempt to do something like that?

This comment seems to conflate resistance to mass surveillance with resistance to targeted surveillance. It's almost as if the fact that I'll never be able to resist a targeted attack means that I shouldn't attempt to have any privacy at all, but surely that's not right.

Encrypted messaging apps and services like ProtonMail have never been primarily to help people with Snowden's threat model. They're for people like you and me to reclaim a semblance of privacy, and they work even with "Uncle Sam" as the threat model in a limited, dragnet surveillance sense.

> They're for people like you and me to reclaim a semblance of privacy, and they work even with "Uncle Sam" as the threat model in a limited, dragnet surveillance sense.

They don't work, because the US government's modus operandi is compromising machines or forcing users to provide access to their encrypted data. It's unclear to me why, if you take as premise a government capable of forcing one of the most valuable organizations in the world to hand over its data, you believe a company several orders of magnitude smaller is safe because it's "end to end encrypted" and has servers in Switzerland.

Put another way, I find the concept of a government willing to force Google to give up data but unwilling to use operational vulnerabilities to achieve the same thing to be contrived - how is this not just an arbitrary line in the sand?

Furthermore, the heuristic itself is a red herring, in my opinion. It is far more likely that Protonmail has a critical security vulnerability inherent to its software than Gmail does. And even if we assume that the government doesn't want to spend economic resources on actively compromising you as an individual, why would the government not spend resources on a system to compromise you passively as part of an en masse campaign? In other words, are you using a custom built computer with parts designed by a boutique firm from another country immune to the wiles of government backdoors?

How do you decide where you want to stop down the rabbit hole, and are you really doing so empirically?

"Put another way, I find the concept of a government willing to force Google to give up data but unwilling to use operational vulnerabilities to achieve the same thing to be contrived - how is this not just an arbitrary line in the sand?"

In the US we have a constitution the prohibits searches of our papers without a warrant signed by a judge. It might be out of fashion is some circles, but the rule of law and not just rule of power is quite popular and I would say a superior system of governance. Many Chinese who are acquiring assets outside of China feel the same way.

Those laws are implemented by humans who don't always follow them, or only follow them for certain groups of people.

"willing to force Google to give up data" first they issued a gag order, and then they came for the gold

"use operational vulnerabilities" am I the only one who strongly believes that Micro$oft is in bed with every 3-leter-agency in haning out backdoors/vulns for the last 20 years?

With the current legal uncertainty around whether your fingerprint or retina scan locking your device has the same legal protection as a passcode - do you _really_ think every Three Letter Agency isn't operating under flimsy legal advice that "papers" does not include anything stored digitally? "The rule of law" is _very_ open to interpretation... (And it's not like parallel construction isn't a well known tool used to hide questionably legal (or outright illegal) law enforcement activity from whatever limited oversight they have anyway... A "Superior system of governance"? My opinion differs somewhat there...)

Email is one backdoor less to care about, step by step you can regain total privacy with project like these

"They don't work, because the US government's modus operandi is compromising machines or forcing users to provide access to their encrypted data."

I'm not so sure - at least as recently as 2013, Lavabit showed that even top level US govt targets had some realistic reliance on properly encrypted 3rd party email providers...

The "dragnet" is the thing that's potentially useful - if it's difficult enough for them, they can't do warrantless "full take" surveillance - even for non US citizens, then choose to individually target you later based on a complete historical record being open to keyword/"selector" based searches.

(And for the appropriately paranoid - even Levison's comments back then suggested the thing he was prepared to fight and maybe go to jail for was handing over the SSL key that'd have exposes _all_ users. Reading it the right way suggests he may have sold Snowden out on his own - and I can't exactly say I wouldn't have done so myself in his position - but he was principled enough to not hand over the keys to the entire userbases's security. I sincerely hope _I_ never have the protection of privacy of a user like Snowden being my responsibility while the full pressure of the US government bears down on me. I strongly suspect my strongly-held personal principles would not stand up to that...)

> This comment seems to conflate resistance to mass surveillance with resistance to targeted surveillance.

ProtonMail doesn't meaningfully address the mass surveillance aspect, though. Most emails still hit its servers in plain-text form. Encrypting once it hits their server doesn't help the mass surveillance aspect, it only helps the targeted surveillance when a warrant comes in.

And if you're willing/able to get everyone that emails you to switch to PGP to get real end-to-end encryption then protonmail is worth even less, since none of their benefits matter anymore (google is obviously not able to decrypt your PGP emails, either).

And sadly - if someone emails a PGP encrypted mail to a protommail address using a key the recipient knows but protonmail doesn't - it doesn't work. Protonmail gives an "unable to decrypt" error, and doesn't hand over the encrypted body...

For me - I think they're useful protecting against dragnet "full take" surveillance (especially since I'm a non-US citizen, so am considered "fair game" for warrantless surveillance), but I don't for a moment think they'll protect me from any sort of state actor level interest targeting me specifically (I'm still gonna get Mossad`ed upon...)

(In more paranoid moments, I suspect that the first "dragnet" protection quite probably makes the second "targeted interest in _me_" more likely...)

Uncle Sam can’t dragnet root everyone’s machine, but they can (and do) dragnet surveil large email providers not focused on security.

“The government can hack anyone, just give up” is a dumb objection if you view security from an economic perspective. Defenders have a huge advantage over attackers that we aren’t sufficiently taking advantage of yet.

I am more worried about hacking from a competitor than I am from the government. That being the case, I trust Google far more than most.

I am not sure I understand the “fear” of the US government. Do we have cases of “normal” people being harmed from NSA type activities? We’ve had a ton of cases of normal people being harmed from non-government “hackers,” so, from a risk management perspective it seems silly to prioritize surveillance avoidance over garden variety thieves. To think Proton has the same level of experience and technology that Google has is a bit naïve.

And server location doesn’t particularly mean much. Plenty of Swiss banks have been compelled to turn over US citizen information due to FATCA — it’s not a stretch that a legitimate request for information by the US government would be honored by the Swiss if it pertains to a US citizen. For non-US citizens, there might be some benefit to an offshore server, however email is generally not the weakest link in surveillance. Also, you’d need to ensure that all your recipients are also using non-US as well as non-British, or non-French systems as well.

US surveillance is in the spotlight, but France and the UK are equally aggressive, if not more so since the actual laws in the UK and France are much more liberal in terms of allowing government to intercept communications. The French law doesn’t even require a judge (secret or not.)

https://www.recode.net/2015/11/14/11620670/france-has-a-powe...

And then there is this law In Switzerland— backed by almost 70% of voters:

http://www.bbc.com/news/world-europe-37465853

I think Proton is a nice alternative, but other than effective marketing, there isn’t much differentiation from paid Google Apps/Gmail plans. Comparing “free” gmail with Proton isn’t exactly honest, comparing paid gmail to Proton is probably a more valuable comparison.

With Gmail, for example, it’s possible to get a Business’s Associates Agreement for HIPAA compliance.. which means that it’s possible to have email that’s more secure than “normal” free Gmail. Of course HIPAA isn’t relevant to government surveillance, but really, how many people are actually at risk from the NSA? If that concern is part of your risk profile, then perhaps you ought to be living in a Tora Bora cave with messages being delivered encoded with a one time pad. If you are worried about your Antifa or KKK meeting minutes being intercepted, it’s likely Proton isn’t going to be much help.

Huge advantage? Can you elaborate?

Uncle Sam can read paper. If Uncle Sam is the threat vector you're better off using telepathy.

In other words, your comment is pointless.

100% correct. Even with fully patched software/OS/hardware/drivers/firmware we are regularly 'surprised' by a number of 0-day vulns that has been around for 1-2-5-10 years and 'suddenly' we discover it/them.

Putting my tinfoil hat on, I'd say that they got a new-improved way to get in, and they patch the old one because now the 'others' got whiff of this (e.g. shadowbrokers) and are about to start abusing it themselves :)

From my favourite ever Usenix paper:

https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Threat: The Mossad doing Mossad things with your email account

Solution:

* Magical amulets?

* Fake your own death, move into a submarine?

* YOU’RE STILL GONNA BE MOSSAD’ED UPON

Seconded! You could add Tutanota + 1$ per month = you will never see ads for a <insert_item_name> like the one you just bought, plus you will be driving Uncle Sam crazy!

This is not a good heuristic, for several reasons.

First and foremost, despite widespread fetishization of things like end-to-end encryption, real world software rarely differentiates its security based on superior cryptography. Most security vulnerabilities occur at the endpoint level and are not even technical vulnerabilities, they're just successful, targeted phishing campaigns. The next most common set of vulnerabilities are in mundane software, typically in the infrastructure and peripheral logic. These are due to developer ignorance, misconfiguration or sometimes both. From there we have crypto implementation flaws, which are typically due to software engineers' fascination with implementing their own cryptography libraries or taking strange liberties with existing libraries that deviate from the explicit or implicit intentions of the original author. Finally, on a peak so remote and small it's scarcely visible from the ground, we have actual cryptography design flaws, where someone literally rolls their own crypto at the conceptual level and deploys it.

Second, email is a fundamentally antagonistic medium when it comes to end-to-end encryption. If you are actually concerned about your privacy and you're discussing something that warrants extreme care, email is the least user-friendly and most error-prone method of going about it. You should consider a synchronous medium with forward security if possible, probably based on a well-known and well-audited messaging protocol (to avoid a flame war I'm not going to suggest any particular one - do your research).

Third, if your threat model is honestly the US government, you need to significantly revise your opsec entirely if you're realistically considering Protonmail. Regardless of its actual security, you're (implicitly) saying that you trust Protonmail to be capable of withstanding the resources of a motivated three letter agency with an armada of security compromising tools at its disposal. Why trust a third party at all then? What makes you think the servers being in Switzerland is going to help you if you distrust the government this much? By all means, don't use Gmail either, but then Protonmail isn't really a coherent security measure either - again, use a synchronous messaging platform, or develop the opsec needed to consistently use PGP correctly on your own.

Given the foregoing, if your adversary is actually the US government, neither Gmail or Protonmail are effective strategies, and if your adversary is not the US government, Google's security team is vastly more qualified and has overwhelmingly more resources at its disposal to secure its email infrastructure.

A missing threat model gives this more credit than it merits. You can replace 'zero knowledge' with 'military grade' and it will be just as meaningful (if somewhat more obviously poor).

Plus, you could say they are describing a threat model. If ProtonMail were compromised in this one particular way the confidentiality of your mail would be 'stronger' or 'improved'. This should be as reassuring as 'Switzerland', which is, of course, also trotted out.

ProtonMail has a publicly available threat model: https://protonmail.com/blog/protonmail-threat-model/

Without a threat model (that is, the set of threats that one is trying to secure a system against), you have no idea what someone means by "secure". It could mean unpickable doorlocks, it could mean unbreakable windows, it could mean angry-Hippopotamus-proofing. It could mean that you smelly farts can't escape your pants.

Any claim of security without a threat-model is in the most literal sense meaningless. And don't get me started on "Military Grade Encryption", which is a term that at this point should give you a sense of concern, rather than safety.

Any claim of security without a thread-model

I'm not sure I understand what your counterpoint here is since we seem to be saying the same thing but I had to go back and fix 'thread model' twice myself. An underestimated threat model to commenting about threat models!

I am sorry, I misread your comment slightly, which resulted in the polar opposite meaning. English is a fun language. :)

Reply on news.ycombinator.com